Check Detail
live-place.com · HEADER
Incomplete
Grade F
11.5%
Result Detail
HEADERAlerts
- Strict-Transport-Security: Strict-Transport-Security missing
- Content-Security-Policy: Content-Security-Policy missing
- X-Content-Type-Options: Header missing
- X-Frame-Options: Header missing
- Referrer-Policy: Header missing
- Permissions-Policy: Permissions-Policy missing
- Cross-Origin-Opener-Policy: Header missing
- Cross-Origin-Embedder-Policy: Header missing
- Cross-Origin-Resource-Policy: Header missing
- Expect-CT: Expect-CT missing
- X-Permitted-Cross-Domain-Policies: Header missing
- Access-Control-Allow-Origin: Access-Control-Allow-Origin missing
- Server: Sensitive header exposed
- X-Powered-By: Sensitive header exposed
- Origin-Agent-Cluster: Header missing
Normalized headers
| x-powered-by | PHP/8.1.33 |
|---|---|
| expires | Thu, 19 Nov 1981 08:52:00 GMT |
| cache-control | no-store, no-cache, must-revalidate |
| pragma | no-cache |
| set-cookie | fm_site_session=feeo3qvd1douaa6imonkloe7g9; expires=Wed, 15-Oct-2025 13:26:26 GMT; Max-Age=7200; path=/ |
| content-type | text/html; charset=UTF-8 |
| date | Wed, 15 Oct 2025 11:26:26 GMT |
| server | Apache |
Transport
| Check name | Status | Actual | Expected | Detail | Severity | Recommendation |
|---|---|---|---|---|---|---|
| Strict-Transport-Security | ⚠️ Attention | max-age>=15768000; includeSubDomains; preload | Strict-Transport-Security missing | Critical | Strict-Transport-Security: max-age=63072000; includeSubDomains; preload | |
| Expect-CT | ⚠️ Attention | enforce; max-age>=86400 | Expect-CT missing | Medium | Expect-CT: enforce, max-age=86400, report-uri="https://report.example.com" |
Content Security
| Check name | Status | Actual | Expected | Detail | Severity | Recommendation |
|---|---|---|---|---|---|---|
| Content-Security-Policy | ⚠️ Attention | default-src 'self'; frame-ancestors 'none' | Content-Security-Policy missing | Critical | Content-Security-Policy: default-src 'self'; frame-ancestors 'none' |
MIME
| Check name | Status | Actual | Expected | Detail | Severity | Recommendation |
|---|---|---|---|---|---|---|
| X-Content-Type-Options | ⚠️ Attention | nosniff | Header missing | High | X-Content-Type-Options: nosniff |
Framing
| Check name | Status | Actual | Expected | Detail | Severity | Recommendation |
|---|---|---|---|---|---|---|
| X-Frame-Options | ⚠️ Attention | DENY or SAMEORIGIN | Header missing | High | X-Frame-Options: DENY |
Privacy
| Check name | Status | Actual | Expected | Detail | Severity | Recommendation |
|---|---|---|---|---|---|---|
| Referrer-Policy | ⚠️ Attention | strict-origin-when-cross-origin / same-origin | Header missing | Medium | Referrer-Policy: strict-origin-when-cross-origin |
Browser Features
| Check name | Status | Actual | Expected | Detail | Severity | Recommendation |
|---|---|---|---|---|---|---|
| Permissions-Policy | ⚠️ Attention | camera=(); geolocation=(); microphone=() | Permissions-Policy missing | Medium | Permissions-Policy: camera=(), geolocation=(), microphone=() |
Cross-Origin
| Check name | Status | Actual | Expected | Detail | Severity | Recommendation |
|---|---|---|---|---|---|---|
| Cross-Origin-Opener-Policy | ⚠️ Attention | same-origin | Header missing | High | Cross-Origin-Opener-Policy: same-origin | |
| Cross-Origin-Embedder-Policy | ⚠️ Attention | require-corp | Header missing | High | Cross-Origin-Embedder-Policy: require-corp | |
| Cross-Origin-Resource-Policy | ⚠️ Attention | same-origin | Header missing | Medium | Cross-Origin-Resource-Policy: same-origin | |
| Origin-Agent-Cluster | ⚠️ Attention | ?1 | Header missing | Low | Origin-Agent-Cluster: ?1 |
Caching
| Check name | Status | Actual | Expected | Detail | Severity | Recommendation |
|---|---|---|---|---|---|---|
| Cache-Control | ✅ OK | no-store, no-cache, must-revalidate | no-store, private, max-age=0 | no-store, private, max-age=0 | High | Cache-Control: no-store, private, max-age=0 |
Legacy
| Check name | Status | Actual | Expected | Detail | Severity | Recommendation |
|---|---|---|---|---|---|---|
| X-Permitted-Cross-Domain-Policies | ⚠️ Attention | none | Header missing | Low | X-Permitted-Cross-Domain-Policies: none |
CORS
| Check name | Status | Actual | Expected | Detail | Severity | Recommendation |
|---|---|---|---|---|---|---|
| Access-Control-Allow-Origin | ⚠️ Attention | Scoped origin (no wildcard) | Access-Control-Allow-Origin missing | Medium | Access-Control-Allow-Origin: https://app.example.com |
Information Disclosure
| Check name | Status | Actual | Expected | Detail | Severity | Recommendation |
|---|---|---|---|---|---|---|
| Server | ⚠️ Attention | Apache | Header removed or generic | Sensitive header exposed | High | Remove Server header or set to a generic token |
| X-Powered-By | ⚠️ Attention | PHP/8.1.33 | Header removed | Sensitive header exposed | High | Remove X-Powered-By header |
| X-AspNet-Version | ✅ OK | Header removed | Header not exposed | Medium | Remove framework version headers |
Raw headers
HTTP/2 200 x-powered-by: PHP/8.1.33 expires: Thu, 19 Nov 1981 08:52:00 GMT cache-control: no-store, no-cache, must-revalidate pragma: no-cache set-cookie: fm_site_session=feeo3qvd1douaa6imonkloe7g9; expires=Wed, 15-Oct-2025 13:26:26 GMT; Max-Age=7200; path=/ content-type: text/html; charset=UTF-8 date: Wed, 15 Oct 2025 11:26:26 GMT server: Apache